Music industry makes more each year - <AUTHOR> http://grabstats.com/statcategorymain.asp?StatCatID=9

<comment><USER3> Anytime I see this kinds of numbers, the first thing I think about is - <USER2> about inflation?

Sadly, without proper information about what these numbers represent, and without accounting for inflation, there is no easy way to compare them.

<comment><USER4> I am sad to see you downvoted because you are right. Wikipedia says 1.4% for 2010 in the USA [http://en.wikipedia.org/wiki/List_of_countries_by_inflation_...](http://en.wikipedia.org/wiki/List_of_countries_by_inflation_rate)

I'd call quite significant and an important factor if you compare money over time.

<comment><USER5> I'm not sure, but is there anything to the fact that the people buying music experienced the same inflation?

</comment></comment></comment><comment><USER6> The important point (for me) is not how much money is being lost due to piracy, but whether the internet as it stands is destroying the music industry. Clearly it is not. The music industry, on the other hand, is currently bent on destroying the internet.

<comment><USER7> I think it is important to be wary of who piracy actually hurts though. I very strongly believe that piracy does hurt someone in the music industry, not the artist, but rather the major record labels.

I remember seeing stats 4 years ago that the income of a musician is actually going up pretty drastically because musicians are starting to go independent (book their own shows, record and release their own records, get their own shirts made to sell).

It takes a lot more work, and a lot of musicians just want to be in the music industry for the music, but they have to (and are starting to) accept that taking part in the business side of the industry will help put more food on their plates and give them nice places to live.

The major record labels will probably stay around for a long time thanks to highly commercial pop/rap artists, but it currently looks like they are attacking everything around them in a desperate attempt to keep all these artists going independent, and to keep the (relatively small) amount of revenue lost from piracy.

It is absolutely nuts that musicians used to get 5 cents for a record sale, and it is an absolute blessing that independent artists are getting most of the money from their record sales!

For purposes of what I posted I think it's good to consider artists who sell music via Topspin, Tunecore etc. as independent artists.

</comment></comment><comment><USER8> The clear implication being that there is really no loss from piracy. While this point could be argued, these numbers show nothing. First off, we don't know how much money would have been made had there been no piracy - that is, the music industry might have made even more money every year. The other issue is that while the music industry's worldwide revenues have increased, recorded music revenues have actually decreased, with North American revenues falling from $13 billion in 2007 to $12.6 billion in 2010, and worldwide revenues falling from $35.4 billion in 2009 to $35.1 billion in 2010. Of course, by that same note it can't simply be claimed that the loss is because of piracy. It may be that people are simply buying less music.

<comment><USER9> These stats don't start until 2006, which after the Napster revolution killed the CD store. I don't think these stats are useful for making any argument about the impact of piracy.

<comment><USER5> Exactly, piracy is the boogeyman they use to excuse any hit in their revenues. Since a downloaded song does not automatically equate to a lost sale there's no way to know how much of an impact it had. Plus the industry often ignores the long tail potential of a downloaded song, i.e., the person downloading the song likes the band they just found and goes to a show or buys merchandise. Of course, in that scenario the artist directly benefits and not the corporate members of the RIAA.

I would like to equate a dip in revenue to the bad PR the industry has gotten over the years by suing grandmothers for downloading songs, requiring purchasing songs multiple times because of multiple devices, making it difficult/illegal to copy purchased songs from one media to another, bribing politicians to create laws to their advantage over the consumer, so on so on. But I have no way to prove much like there's no way to prove piracy is killing their industry.

I'm willing to bet a dip in revenues could be attributed to the fact that we can legally stream music all we want either free or a small subscription fee through services such as Pandora or Spotify. I for one haven't felt the need to purchase music in years and I don't obtain music illegally.

Based on these kinds of reports though, the industry just seems to be doing fine to me. A dip in revenues from 13 billion to 12.6 billion is not a disaster. It's a statistical blip.

</comment></comment></comment><comment><AUTHOR> to me the numbers show that album sales are down because of an unbelievable change in the way that people buy music today as compared to 15 years ago. Buying a single song has replaced buying an album. The RIAA is claiming that album sales are down like 90 percent. DUH... but that's not due to piracy, it's due to itunes raking in 9 billion dollars for the music industry. If the itunes downloads were the 10 dollars or more that an album costs..... well you can do the math. So downloading may be killing the record labels, but it's the LEGITIMATE downloading of songs.

If you think about it, apple takes HALF of the price of a download, so that's 18 BILLION downloads last year alone.

</comment><comment><USER10> I wonder if WP7 is going to help Microsoft in regards to this..

"US MP3 Player Retail Sales, by Brand, February 2007 (% market share)

Apple (73.7%), San Disk (9%), Creative (3.3%), Microsoft (2.3%), Samsung (2.2%), Other (9.5%)"</comment>


Anonymous Vows to Strike Israel with 'Electronic Holocaust' - <AUTHOR> http://www.tripwire.com/state-of-security/latest-security-news/anonymous-vows-to-strike-israel-with-electronic-holocaust/

<comment><USER2> "AnonGhost, a group -that is said- to be affiliated with the global hacking group Anonymous"</comment>


Ask HN: Someone just stole my iOS app's name... What should I do? - <AUTHOR>

Hi all,
I am currently developing a game application for iOS devices, however a competitor has just released a very similar game using the exact name I wish to use (e.g. It's like I am developing a black-jack card game and a competitor has just released a similar card game for sale in the app store called "black-jack").
Although I'm obviously biased, I think my game is a superior implementation and is ultimately a much more polished app. Accordingly, I believe that my app is a better product overall and would be obviously different if customers were choosing between my app and my competitor's app (i.e. similar functionality/gameplay, but completely different user interface).
The problem is I want to keep the name if possible since the name describes the game itself, I have secured a relevant domain name, and the name is still available in the Android market (which would be my second target market).
What would you suggest?
* 1. Should I persist and submit the app under the "shared" name? (Wouldn't a submission like this be rejected straight away?) * 2. Should I change my app's name subtlety to differentiate my product? (e.g. something like "black-jack.com's black-jack" or "iBlack-Jack" instead of just "black-jack" which is already taken) * 3. Should I just cut my losses with the app store and concentrate on the Android Market?
Any help/advice would be greatly appreciated.
Cheers,<AUTHOR> <comment><USER2> The word "stolen" is misleading- if I read you well. I would suggest you to rephrase your post if you want to be taken seriously

<comment><AUTHOR> As suggested, I just tried to change the title but the "edit" option is no longer available for this item on my submissions page... Any ideas?

</comment></comment><comment><USER3> If you think you have a superior product then don't 'cut your losses' :)

Change the name of your app. From what I can tell, the app name in question is very generic since it

a) describes the game itself

b) was taken up by a competitor in the same field

Give it a more unique name.

Canabalt sounds much nicer than 'iRunner'

Frankly, if I were looking for a blackjack game, I would be more likely to click on one called 'DoubleDown' than one called 'BlackJack' (though admittedly that's just me)

Keep your current domain name the same and use it or additionally secure another domain for your app.

Names are overrated. If you don't believe me, look at the names of some of the top sellers

</comment><comment><USER4> If the name in question is truly generic then consider a name like "BlackJack Pro" or "BlackJack Plus". That way you get the benefit of appearing alongside your competitor's implementation in any search for BlackJack, and give the impression you're offering a superior product.

If the name isn't truly generic you might run into major trademark issues doing that, of course.

</comment><comment><USER5> I don't think you'll even be able to complete the submission process with a duplicate name.

One tip I would offer is to use your competitor's app name in your list of keywords so you can come up next to them in searches. I suppose that might be dirty pool to some but it's worth a shot if you have some space left for extra keywords.

</comment><comment><USER6> the answer is plain - change your app name.</comment>


Microsoft Open Sourcing the Quantum Development Kit - <AUTHOR> https://github.com/microsoft/QuantumLibraries <comment><AUTHOR> This and other gate level quantum softwares like Forest (Rigetti), Qiskit (IBM), Cirq (Google-not official) can be checked for more information in [1].

[1]: [https://arxiv.org/abs/1807.02500](https://arxiv.org/abs/1807.02500)

</comment><comment><USER2> … they open sourced it in THIS timeline, at least.</comment>


Show HN: AnyDesk – Realtime Screen Sharing with Specialized Video Codec - <AUTHOR> http://anydesk.com/ <comment><USER2> Well, as this graph[1] clearly shows... Red is the winner! Also... this graph doesn't seem to match up with the data provided in the benchmark PDF[2]... unless you truncated it for some reason. At least one of them should be 50% of the red bar.

Two more things:

1) Is there a reason you don't list what version of RDP you are using? There is a big bump in quality with 8.0

2) Is there a reason you don't include other paid offerings in your benchmark? Since you offer paid versions it seems like that would be fair.

[1] [http://anydesk.com/_static/img/benchmark- framerate.png](http://anydesk.com/_static/img/benchmark-framerate.png)

[2] [http://anydesk.com/benchmark/anydesk- benchmark.pdf](http://anydesk.com/benchmark/anydesk-benchmark.pdf)

</comment><comment><USER3> I really HOPE this trend of websites breaking the scroll will die soon.

Please let my mouse wheel work as supposed.

Thanks

<comment><USER4> Yeah, it was really jarring when I scrolled down. This one was a LOT worse than others that I've seen.

</comment></comment><comment><USER5> You have mistake in translation to Polish. "Latency" should be translated as "Opóźnienie" not "Latencja", which means incubation period of viruses.

</comment><comment><USER6> or you could use Brynhildr and get sweet 60fps for free [http://blog.x-row.net/?p=2455](http://blog.x-row.net/?p=2455)

Obviously Im not the target market. I expect my VNC program to tell me things like port numbers, bandwidth utilisation and codec used, not treat me like an idiot.

</comment><comment><USER7> Did I miss the Mac version or is that not available? Show-stopper for just about everyone I know.

<comment><USER8> Ah, such a shame there nothing for Mac right now, I'm always looking for a faster remote that'll work with challenging bandwidth on the road.

<comment><USER9> I use/work for Sococo, and we're also working on the 'challenging bandwidth' issue. Fortunately VP8/9 have lots of knobs to turn that can be used to control bandwidth.</comment></comment></comment>


Start a startup? I am an undergrad student. - <AUTHOR>

I am Computer Engineering student in 3rd year from south asia. I am very energized to getting up an running a startup and take some height. As now we have to do a minor project to submit, I don't want to make it just a project of 3 months rather I think of taking this project to some height to solve real world problem and I am quite serious about it. I wish you guys help me giving some guidelines where and how to start and what I should consider at this moment or provide me some useful links. Like how I chose my partners to start this project, what things should I consider, even money, location. I am thinking of doing project based on internet/web specially. I am confident and have energy to give my all 24 hours a day for this. I am really excited. Suggest me somethings. <comment><USER2> Go for it, you'll learn a lot and it will look good on your resume.

Do you have an idea already?

</comment><comment><USER3> usually student projects are of low technical quality (eg, what they teach you is useless in real world). So unless you got some other real life experience i would not bother.

<comment><USER4> I think the projects' goals are fairly trivial but the mechanisms behind the suggested projects are excellent learning tools, especially when you can get professor/peer feedback.

But if you think you can somehow improve or expand upon the stock project assigned to you in class, then by all means work on it in your free time...the worst that can happen is you learn more programming (oh no!).

As for general advice, talk to your peers about the idea (I assume they are working on the class project as well) and get as much feedback as possible. Maybe they'll see something you didn't which may or may not motivate you to continue working on your idea. Talk to as many people as possible and you may find a partner through your research (don't worry about others stealing your idea so long as you keep all the really juicy details to yourself).

</comment></comment><comment><USER5> Those topics have been covered in depth dozens, if not hundreds of times on HN.

[http://lmgtfy.com/?q=site%3Anews.ycombinator.com+choose+part...](http://lmgtfy.com/?q=site%3Anews.ycombinator.com+choose+partner)

[http://lmgtfy.com/?q=site%3Anews.ycombinator.com+startup+loc...](http://lmgtfy.com/?q=site%3Anews.ycombinator.com+startup+location)

[http://lmgtfy.com/?q=site%3Anews.ycombinator.com+incorporati...](http://lmgtfy.com/?q=site%3Anews.ycombinator.com+incorporation)

[http://lmgtfy.com/?q=site%3Anews.ycombinator.com+startup+ide...](http://lmgtfy.com/?q=site%3Anews.ycombinator.com+startup+ideas)

<http://lmgtfy.com/?q=site%3Anews.ycombinator.com+market+fit>

[http://lmgtfy.com/?q=site%3Anews.ycombinator.com+merchant+ac...](http://lmgtfy.com/?q=site%3Anews.ycombinator.com+merchant+account)

[http://lmgtfy.com/?q=site%3Anews.ycombinator.com+startup+law...](http://lmgtfy.com/?q=site%3Anews.ycombinator.com+startup+lawyer)

[http://lmgtfy.com/?q=site%3Anews.ycombinator.com+business+pl...](http://lmgtfy.com/?q=site%3Anews.ycombinator.com+business+plan)</comment>


Breach exposed more than one million DNA profiles on a major genealogy database - <AUTHOR> https://www.buzzfeednews.com/article/peteraldhous/hackers-gedmatch-dna-privacy <comment><USER2> And half the DNA of all of the siblings and parents of the people that submitted their DNA, a quarter of their grandparents and grandchildren and so on. That's what I really hate about these companies, they get people to submit their DNA and the customers do not realize it isn't a decision that affects just them.

<comment><USER3> So I should get the consent of my entire extended family before I ever submit my DNA to a service for analysis?

<comment><USER4> Your data, your rules. I put my 23andme raw data in github ([https://github.com/sbassi/MiGenomaSbassi](https://github.com/sbassi/MiGenomaSbassi)) for the world to see and use without asking anybody in my family.

<comment><USER5> I strongly disagree. I consider it comparable to something like financial administration. In which an "expense" or "exchange" has two sides. Me, paying you, you receiving the money.

It is not up to me to decide to just release such data. Because it encodes other people's data too. If I were to release my financial records because "it's my data", i'd be exposing a lot of people, organisations and companies who I had interaction with.

<comment><USER6> But it _is_ up to me to decide to release my financial records. All the parties I've dealt with have to expect the possibility (unless there is some signed agreement that prevents disclosing them).

With DNA I'm not so sure.

<comment><USER5> I'm pretty sure that if <insert ecommerce platform here> were to leak all their financial transactions, that is considered a large data-breach and would be considered a privacy infringement.

I am aware that "an ecommerce platform" is something else than "your personal finance", but the principle is the same: X shouldn't release other people's financial transactions just because those were done with X.

</comment></comment></comment></comment></comment></comment><comment> site-packages1 For those who are annoyed about the name of the site not being in the title: GEDMatch was phised a few days ago, then yesterday phishing led to the data exfiltration from the Israeli DNA site MyHeritage.

[https://www.myheritage.com/](https://www.myheritage.com/)

<comment><USER7> I thought myheritage was owned by the Mormons.

<comment><USER8> Just out of curiosity, is there a reason for Mormons to especially care about their genealogy?

<comment><USER9> > One of the core tenets of Mormon faith is that the dead can be baptized into > the faith after their passing. Baptism of the dead evolved from the beliefs > that baptism is necessary for salvation and that the family unit can > continue to exist together beyond mortal life if all members are baptized.

> Mormons trace their family trees to find the names of ancestors who died > without learning about the restored Mormon Gospel so that these relatives > from past generations can be baptized by proxy in the temple. For Latter-day > Saints, genealogy is a way to save more souls and strengthen the eternal > family unit.

[http://www.pbs.org/mormons/etc/genealogy.html](http://www.pbs.org/mormons/etc/genealogy.html)

<comment><USER10> That leads to my afterlife nightmare scenario.

I die bravely in glorious battle and am chosen by the Valkyries for Valhalla. One evening as we feast after that day's fighting, quaffing giant tankards of mead and boasting of our deeds, there comes a knock at the door.

Two young men in suits enter, and go to speak to Odin.

Odin then call for me to come over. He tells me that the young men are Mormons, and that some distant relative born long after I died (great-grandkid of a second cousin or something like that) has joined the Mormon church and has been busy baptizing the whole damn family tree.

Odin tells me I'm Mormon now, and cannot stay in Valhalla. I must move to the Mormon afterlife.

(Actually, the Mormon afterlife doesn't seem all that bad compared to that of most Christian or Christian-adjacent religions, in the sense that if you reject their teachings but still live a decent life you get a decent afterlife).

<comment><USER11> I believe the "if you live a good life you go to heaven" is a common tenet of many Christian denominations since the Vatican Council.

At least, I recall my religion teacher (a catholic priest, we have such a class in public schools in Italy tho they vary in content and quality) telling us that some decades ago.

You do not go to heaven if you're an atheist tho, as _denying_ there is something divine puts you in the bad list, sorry.

<comment><USER12> I mean does it really matter what the church says? The important part is what God actually thinks here and that seems to be very different depending on who you ask.

<comment><USER13> To be more precise, what matters is not so much what God/gods "think", but what they want us to do. In this case, the textual foundation for Extra Ecclesiam nulla salus is Mark 16:16: "Whoever believes and is baptized will be saved; whoever does not believe will be condemned." Assuming these really are the words of Jesus, they leave very little for interpretation, no matter what Vaticanum II says.

<comment><USER14> These can not be the words of Jesus since the language of these words did not exist at the time (assuming a deity that doesn't express itself in yet unformed languages).

<comment><USER15> Is this better?

"ὁ πιστεύσας καὶ βαπτισθεὶς σωθήσεται, ὁ δὲ ἀπιστήσας κατακριθήσεται."

That's the closest we can get, although Jesus would have assumedly spoken these words in Aramaic, not Greek.

Source: [http://bibletranslation.ws/trans/markwgrk.pdf](http://bibletranslation.ws/trans/markwgrk.pdf)

</comment></comment></comment></comment></comment></comment></comment></comment></comment></comment><comment><USER16> " _As a result of this breach, all user permissions were reset, making all profiles visible to all users_ "

This seems like the opposite of how a sensible permissioning data model should work.

<comment><USER17> "But A/B testing showed more 'user engagement' when you default to public"

<comment> W-_-D Who are you quoting there?

<comment><USER18> wooosh

</comment></comment></comment></comment><comment><USER19> Can someone explain the potential short to medium term fears of one's DNA leaking? My initial assumption is that it would be less of a problem compared to nearly any other personal data leaking. Like it certainly sounds creepy, but credit card or other financial data being stolen presents a huge headache and creates a lot of work.

I understand that in specific instances, for example when paternity is in question or if a person is hiding from someone this information getting out could be catastrophic, but that applies to such a tiny portion of the population. So for most people, what is the downside to some random individual knowing the country of origin one's ancestors are from or that they might have a genetic predisposition to heart disease? It isn't like any reputable company is going to be able to use this information against us.

Plus in the long term there are likely going to be ways to get this information directly and almost instantaneously from any personal interaction you make since we can't really stop ourselves from shedding our DNA wherever we go.

<comment><USER20> Nothing.

Absolutely nothing.

The DNA records aren't the type that can be used to clone you, or frame you with some kind of non-existent DNA copying machine.

They are autosomal records. (or similar genealogical, or non-medical, types)

The people spinning fantastic fairytales about how the jackbooted thug of big brother is going to crush your throat probably don't even know what autosomal means and no amount of eduction will convince them.

I encourage everyone to submit their Autosomal DNA to public databases. You may bring closure to someone who has been or known a victim of a horrific crime and there is no risk to you.

You have at least one reply about insurance companies using this information to screw you.

1\. This type of information is practically useless, actuarially, and

2\. It has been illegal for them to do so for many years.

<comment><USER21> > there is no risk to you.

There is _always_ risk. You probably don't see it yet just like only privacy- forward folks thought Facebook's encouragement to "share everything" publicly (circa 2007) foresaw the problems that would commit 10+ years later.

The small benefit of closure to a stranger who has already dealt with the grief of loss is not worth it for me. It depends on your personal value system.

> It has been illegal for them to do so for many years.

Laws can change. Just like I always assume a company can screw me after I agree to a ToS (eg. through a pivot, an M&A, or a bankruptcy), I assume any law can change with enough societal acclimation.

Also, laws are relative to where you are. If you try to visit another country, expect that they might have access to your leaked data. Hopefully you never want to work as a spy in the future.

<comment><USER22> Exactly because there is always risk, when it is small - people say there is no risk.

Lots of things can happen and could have happened but never did.

<comment><USER21> > Exactly because there is always risk, when it is small - people say there is > no risk.

This is analogous to the definition of "literally". It was misused so much that a new second definition for the word is close to the opposite of the original definition.

It's still worth mentioning the nuance at least occasionally.

</comment></comment></comment></comment></comment><comment><USER21> As someone who works in cybersecurity, it's always hard for me to interpret PR language like "orchestrated through a sophisticated attack". This could be aimed towards non-savvy readers meaning basically anything or it could be accurate and describe a nation-state (although I don't get the feeling of a sophisticated nation-state actor here).

The DoJ used similar wording when prosecuting Aaron Schwartz for using Python scripts to glue together "curl" calls.

<comment><USER23> To be fair, curl _is_ a nightmare of pedantry without something like postman to deal with it all for you. BTW, when did postman come out anyway?

<comment><USER21> Postman is nice and ergonomic!

curl is great if you already have the command crafted. My suspicion is that the Python script scraping a web page for URLs/IDs which then ran a curl shell command which saved the resulting document to the file system.

</comment></comment></comment><comment><USER24> This is the same level as having a breach of biometric data.

With password/payment/location breaches you have the ability to change what you entered as to invalidate/outdate the data which was stored.

Having your biometric/genome authentication data stolen or made public will be a nightmare.

<comment><USER25> No, not really.

There's no practical way to protect our genomes in meatspace. We're constantly shedding DNA into the environment. Hair, skin, saliva, etc. For example, an adversary can just tail us to a coffee shop or restaurant, and take a utensil or straw or napkin that we've used. And then submit the sample using a fake name, as investigators often do.

Edit: Those are excellent comments about scale. But generally, if you don't want to publicize your genomic data, just don't send in a sample.

<comment><USER26> But you can't do that to a million people, only to individual targets. Economic scale matters in a lot of evil plots.

<comment><USER27> Just wait until these fancy "smart" coffee cups with built-in nano-labs become ubiquitous.

<comment><USER25> Before that happens, I'm guessing that full DNA sequencing at birth will be a legal requirement. Like footprints are now.

<comment><USER28> Holly... You're right. This will happen. To an over-arching state this is the ultimate modus.

      INSERT INTO Citizen(dob,ssn)
      VALUES 2030-10-28, sha(atgcaatgcatcgc..)

<comment><USER29> hashing (sha) is not very appropriate since you're not likely to ever reproduce exactly the same base pair sequence for the same person.

</comment></comment></comment></comment></comment></comment></comment><comment><USER30> I waited for this. Sorry to all that are affected, but maybe this is a sign for others, not to give their DNA to a random company.

<comment><USER31> Yeah, just like people stopped using their real identities on the net where there is absolutely nobody with an axe to grind for trivial issues.

Sorry for the cynicism. What is even worse, people actually using these services create expectations towards everyone smart enough not to do that. Of course, that would mean your near relatives have to be smart enough not to use these services either...

Now any health insurer could use this data to identify high risk genetic defects...

<comment><USER32> Isn't it illegal to use DNA data for purposes of health insurance? How would insurance company be able to use it? Companies like kaiser run both hospitals and insurance, yet they can't use your full medical history when determining your insurance risk.

The bigger issue imho is companies using biometrics as a secure authentication, but at least in USA that's going to be no worse than SSN mess.

<comment><USER31> Legislation is sensible and in larger insurers this promise will probably be kept. But if the info is available, people will look it up. Long time disease risk is interesting to many people.

If you leave your door open, people are still not allowed to steal you things. Do you leave your door open?

</comment></comment></comment></comment><comment><USER33> One thing I'm thinking about: this is probably an inevitable future. That we like it or not technology is going to be more and more intrusive. If not our generation, the next one, or the one after.

We've seen that short-sighted laws have caused more harm than good on the long-term. Like the war on drugs.

Knowing this, is there a future where we can lose privacy but still live a good life? And what can we do to get there?

<comment><USER34> [https://en.wikipedia.org/wiki/Homomorphic_encryption](https://en.wikipedia.org/wiki/Homomorphic_encryption)

<comment><USER35> The cost of that is prohibitive except for very particular cases. On the other hand, even tiny devices have powerful computers nowadays. We don't need 3rd party cloud.

</comment></comment></comment><comment><USER36> The way GEDmatch works you can enter any "kit number" and get a long list of matching people which has their kit number, name, email and some other basic information.

It sounds to me like hackers just managed to traverse the entire database to hunt for emails. Which is not exactly hard given how the site works.

Most kit numbers seem to be a letter and 6 numbers so not exactly hard to brute force either. You don't even have to get that many right as for any hit you might get a list of 1000+ people and use their kit numbers to get even more.

You might say that's a terrible design security-wise but that's what makes GEDmatch great for researching who you're related to. They'll either have to degrade the experience or be really stringent about rate limits and so forth.

<comment><USER37> I can't believe this is a website. It's essentially a rolling data breach.

</comment></comment><comment><USER38> So they sent an email to their users that states:

>We can assure you that your DNA information was not compromised, as GEDmatch does not store raw DNA files on the site. When you upload your data, the information is encoded, and the raw file deleted. This is one of the ways we protect our users' most sensitive information.

This is kind of BS right? It's encoded... not encrypted.

<comment><USER39> Presumably. However, if it was a PR drone who wrote that, it may or may not be accurate as to whether or not it was encoded/encrypted.

I would just assume that it has in fact been compromised though.

<comment><USER40> Or at least a summary version of it with all the data _they_ felt was relevant to keep... so everything we currently know to be important.

</comment></comment></comment><comment><USER41> This is why I've been putting off getting my genome sequenced. One breach and it's out there forever.

I've heard good things about nebula[0] as a way to get an anonymous genome but have yet to be motivated enough to take the plunge

[0] [https://nebula.org/whole-genome-sequencing/](https://nebula.org/whole- genome-sequencing/)

<comment><USER42> What is the impact of having your DNA known? As far as I can tell the worst case scenarios are finding out you have to pay child support or getting placed at the scene of a crime.

If those risks don't apply to you, who cares?

<comment><USER43> If you've got nothing to hide... then make it all public. Let's start with your finances.

<comment><USER42> I openly talk about my finances with anyone who wants to talk personal finance. What threat are you imagining this could pose?

<comment><USER44> let's start with your bank account and routing numbers.

<comment><USER42> I share that information when it benefits me. That's the basis of ACH. Next?

<comment><USER45> Specific pornographic preferences and fetishes? Nothing illegal there, no reason to hide.

<comment><USER42> What is the advantage of sharing that information?

</comment></comment></comment></comment></comment></comment></comment></comment><comment><USER46> This was bound to happen at some point of time. I have been having repeated "conversations" with my dad about why he and I should NOT send a cheek swab to 23andme (or any similar services). Today I think I will be able to drive the final nail in that coffin.

</comment><comment><USER47> Did not take long: [https://mittr-frontend-prod.herokuapp.com/s/614642/dna- datab...](https://mittr-frontend-prod.herokuapp.com/s/614642/dna-database- gedmatch-golden-state-killer-security-risk-hack/)

<comment><USER48> That url is atrocious. It looks like the MIT tech review doesn't pay for its Heroku account.

<comment><USER49> This is the correct URL: [https://www.technologyreview.com/2019/10/30/132142/dna- datab...](https://www.technologyreview.com/2019/10/30/132142/dna-database- gedmatch-golden-state-killer-security-risk-hack/)

</comment></comment></comment><comment><USER50> This is why I want a genetic sequencing lab that will sequence your genome, send it to you encrypted by your own public key and once you confirm receipt and verify it is valid, DELETE IT COMPLETELY. Along with the record you were their customer after the 6 months or whatever required for waiting out chargebacks.

Then you can analyze your DNA with a desktop app that doesn't send out any data.

The deleting part is hard to find.

<comment><USER51> Seems unlikely to be a sustainable business.

For GEDMatch, Ancestry.com, 23andMe, etc, most of the value comes from being able to aggregate many people's data. If they had to delete it after collecting, they'd have to charge a lot more, and there's just no market for that.

Perhaps they could anonymize the data (at least, purge foreign key references to account/billing info) after 6 months, but not delete it.

<comment><USER52> Much like you can't anonymize browsing history data, email metadata or financial transactions -- I suspect DNA information also cannot be satisfactorily anonymized.

"Anonymized data" is a marketing term.

<comment><USER53> Was going to say this as well- I _highly_ doubt it's possible to anonymize DNA and still have useful data.

'Anonymized Data' is a misnomer.

</comment></comment></comment></comment><comment><USER54> Probably the worst breach in history (so far), because unlike anything else, this information can't be changed

</comment><comment><USER55> I understand the desire to trace one's family history, find/treat diseases, discover murderers, etc. However, any time I read about these types of personal information breach events (DNA and genealogy could arguably be the most personal info of all) I so badly wish we didn't have this tech to begin with and how much present day sucks compared to the past as a direct result of these personal data mining tech companies (thinking social media, surveillance as well). I also wish the general population thought more clearly about the long term consequences of their information being in the hands of others before they so naively and/or willingly divulge it. Worse yet, we often don't have the choice. Nightmare scenarios where some could wield such information to do harm are not too difficult to think up, and if we are really being honest with ourselves, are occurring present day. Personal information data playgrounds like Facebook become precision tools for deception and oppression at best, genocide at the worst (thinking Myanmar). Not to single out Facebook, imagine what a psychopathic genocidal leader could do with 23andme data. With the rampant data collection, the human population has never faced this scale and breadth of societal threat before and we are indirectly feeling the consequences of it in our lives daily. I wish we could go back.

</comment><comment><USER56> This quote by John Young of Cryptome sums up the dark truth of the state of cybersecurity:

" Wonder how long it will take to reveal cybersecurity is a Ponzi racket.

Profits from commercial harvesting data of online users now exceeds the total funding of all the global spy agencies, with a healthy chunk of the steal bought by official spies and law enforcement which ignore the violation. Edu, orgs and NGOs part of the rotten racket."

Essentially, every major data breach is planned by the "good guys" having a stake in criminal ops.

</comment><comment><USER57> There should be fines big enough to bankrupt the companies who fail to secure data this kind of data. Is there some other way to convince them to take the issue more seriously?

<comment><USER58> That just pushes them offshore.

I would rather that there be greater security training in software development programs/bootcamps.

I'm a software engineer. I know a lot of software engineers. None of us have ever been trained in security.

Any "best practices" are usually picked up in Stack Overflow conversations.

<comment><USER59> It seems to me that the way to deal with offshoring would be to bring back a modern version of outlawery. The US could basically declare: "Until this corporation pays their fines the US will not prosecute or extradite any individual or corporation who hacks them, steals their physical or intellectual property, declares debts to them canceled, or violates contracts with them."

</comment></comment></comment><comment><USER60> This is why I did my DNA sequencing several years ago with a fake name, a sparkling brand new email address, at a unique domain registered for the purpose, with a fake name as the registrant, paid for with a prepaid card, via a VPN. I downloaded the results and let all of it lapse; other than the DNA itself, it is utterly disconnected from the rest of my digital records.

It's a shame that one has to go to such lengths to safely use health-related electronic services.

</comment><comment><USER61> I've always wondered if this were a worthy business proposition, cause I would definitely buy a product like this:

Basically all of the features of 23AndMe/Ancestry/etc, but done offline. You're given an app to download online, provided all of the hardware needed to spit in a tube, and get the same results.

No data stored on a cloud server, and no centralized database of everyone's DNA. That's probably where the real business model is though.

<comment><USER62> I think you're missing the part where you have to send the tube to a lab to do the actual sequencing. At that point they have your data, and even if there were to be a provider that says they don't keep it, that's about as credible as all the VPNs which "don't keep logs" where we later discover, whoops, they lied...

<comment><USER61> Right, maybe this is where I'm being ignorant, but would there be a way to do the actual sequencing down to a consumer device?

I presume the machines used are pretty complex.

<comment><USER63> DNA sequencers are not that expensive [1]. And I'm told the actual lab work is not that hard or dangerous (high school level?).

I fact, the database correlating millions of people's DNA with their medical history and migration history is probably the hardest part.

But the potential market is there. I'd gladly play $1000 to have my sequence, even unanalyzed, with the knowledge no one else does.

1 cursory look at eBay. I don't know if those sequencing machines are good for human DNA - I hate bio.

<comment><USER64> I'm assuming that you meant to link a MinION (as it's the only device I know of at that price point). They would be fit for human DNA, though a single flow cell (consumable part that will degrade after X amount of DNA read) might not be quite enough to read a whole human genome with the desired accuracy.

So if you purchase all the consumables (flow cells + chemicals) in low quantities, a single human genome will probably run you around $2000 in materials. With the bulk orders from their website you could get it down to half of that (so probably even more if you were doing really big bulk orders).

<comment><USER61> $1000-2000 seems like the price point I was expecting for a full offline solution. It does seem too high for the mainstream market when 23AndMe kits are going for $99 despite all the privacy concerns.

</comment></comment></comment></comment></comment></comment><comment><USER65> I consider myself a fairly optimistic person. Yet here we are deeply immersed in a world of technology that trades privacy for conveniences (that we did fine without before) and week after week these mega data stores are compromised and we just move on. The optimist in me hopes its merely incompetence and greed, but then it seems almost programmatic.

</comment><comment><USER66> Yikes... Now I'm glad I have been telling all my friends who are considering using genealogy database services to use fake names.

</comment><comment><USER67> Like this wasn't just waiting to happen.

You voluntarily hand over your DNA to a private company. What could possible go wrong?

<comment><USER68> Well, I'd add : You voluntarily hand over your DNA to a private or public company. Makes no difference. The bigger the trove, the finer the hackers.

</comment></comment><comment><USER69> That's why I bought the tests on Amazon on Father's Day sale. Then used completely fake info and fake email to register on the testing company site. Totally anonymous as there's no way to link the purchase to results.

<comment><USER70> Eventually that data will become associated with your real identities. How could it not? you're obviously so-and-so's grandfather/first-cousin/whatever, and they gave their names.

</comment></comment><comment><USER71> I wonder if we're getting close to being able to synthesize a DNA profile and fool most of the labwork being done.

Most DNA profiles are SNP's and they wont be enough to 'clone' a DNA sample.

</comment><comment><USER72> I'd be only interested in this stuff when we can do our own dna readouts at home and compare it against population level statistics that have been published publicly by researchers

</comment><comment><USER73> Is there a list somewhere of who exactly was exposed? It's difficult to remember which sites I've given DNA to and which I haven't.

</comment><comment><USER74> The human genome is about 3.4B base pairs (G-C, A-T). The specific DNA used for genealogical matching is 700K base pairs. So the testing companies are only using 0.02% of your DNA, hardly enough to compromise you.

Furthermore, the matching process is based on SNPs (Single Nucleotide Polymorphism) and STRs (Short Tandem Repeat) in the "junk" DNA section, which constitute 92% of your DNA, and is distinct from the coding DNA that contains health traits, among others.

So, not much to worry about.

</comment><comment><USER75> Is there any way to get my DNA analysed anonymously? Like, with just a throwaway email and payment via some service that anonymises?

<comment><USER76> At least it was possible for one person to send two identical samples under two different names a few years ago to one company, but if everyone has closed that loophole yet - I don't know.

Alternatively (a business idea for someone here who has already registered?) you could send in other peoples samples in tour name and then request deletion via GDPR or something. Do things that do not scale and all that ;-)

</comment></comment><comment><USER29> Is there a download available? It could be an exciting time to do some bootleg research

</comment><comment><USER77> Let the Clone Wars begin!

On a more serious note, is their any way to have your DNA analyzed confidentially ?

</comment><comment><USER78> Amazing we don't have a law granting each individual copyright of their own genome.

<comment><USER79> Why? Who is going to grease politicians to write that law?

</comment></comment><comment><USER80> Aliens absconded with the DNA records obviously. Connect the dots people!

</comment><comment><USER81> Perfect, so I, a hypothetical nation state can build targeted and tuned viral RNA for phenotypes and people I know will definitely cause me the most trouble on the battlefield, diplomats, engineering floors, and economy? Oh, corona has among the largest kilobase count? Hmmmmmm. What a fucking coincidence!

</comment><comment><USER82> Well that's completely unsurprising.

</comment><comment><USER83> Self-hosted genome sequencing when?

</comment><comment><USER84> Where do I reset my DNA?

</comment><comment><USER85> 1 million and me.

</comment><comment><USER86> Not saying that building databases of DNA is a good idea, but DNA is basically public information. Everyone whose hands you shake (nowadays quite rare) gets copies of it. The Amazon package you get has genes of every human who touched it. If you send it back, you are sending Amazon your genes. The only issue is the sequencing and the consent to use it for purposes like "improving our services" aka improving the ads targeting or insurances (once the DNA company is bought by an insurance). Consent is arguably less of an issue for hackers.

<comment><USER87> It is a bit like face recognition databases. In principle, the data is already public-enough. In practice, building these databases enables qualitatively higher levels of surveillance.

<comment><USER88> How, exactly? It's not like I can use wide-area instrumentation to locate you via your genome. You can imagine how to do it with cameras and faces, but I just don't see the method for DNA.

<comment><USER63> Imagine the BLM protests (since that will probably be popular with the HN crowd).

There's video footage of a guy in a mask spitting on the ground after throwing a rock. He's wearing a mask.

His second cousin did 23 and me.

Actually, statistically many of his second cousins did 23 and me.

Therefore we know who he is.

If only one second cousin did 23 and me, we've narrowed the suspects to, perhaps, a few hundred. Filter by apparent height, gender and you have a very narrow set of suspects.

<comment><USER88> Didn't understand your point. Identifying specific individuals is not the same thing as mass surveillance.

<comment><USER87> But it IS a qualitatively new mode of surveillance that can't exist without large databases.</comment></comment></comment></comment></comment></comment>


Remote Code Execution on the Smiths Medical Medfusion 4000 - <AUTHOR> https://github.com/sgayou/medfusion-4000-research/blob/master/doc/README.md <comment><USER2> It's so sad to me to see that this only has 5 points over 8 hours, and no comments.

This is remarkably well-written, goes into a very reasonable amount of depth (only eliding context-specifically sensitive material) and demonstrates an appropriate level of thoroughness. Most importantly it highlights the critical significance of further research into medical devices.

Last time I happened to be in an ER triage unit I remember noting that the blood pressure monitors decidedly _weren 't_ networked, and they verified the pulse measurements manually (by counting) as well.

It's clear that BP/pulse is such an important measurement that strict redundancy is the standard, but IMO it would be awesome to see the same attitude applied to the manufacturing stages of all devices in medical environments.

</comment><comment><USER3> Wow, great writeup and very interesting but I wish I was smart enough to understand all the stuff happening in this.</comment>


Gah, recruiters, LinkedIn, and a good problem to have - <AUTHOR> http://vazor.com/drop/recruiters.txt <comment><USER2> What an incredibly self-righteous and unnecessary response.

Everyone hates recruiters, fine, I get that. It doesn't change the fact that like you, they are also trying to make a living. They also have friends and family that give a shit about them and despite the fact that they may be exceptionally annoying at times, responses like this are simply rude and unprofessional.

 _6 or 7 no replies is "I'm not interested" in normal person speak._

Wrong. 1 reply of "I'm not interested, please don't contact me again." is normal speak.

Sorry Matt but your response does you no favours and it certainly doesn't educate the recruiter in question.

<comment><USER3> Dude, I get where you are coming from but seriously, the word No doesn't get processed by a salesperson the way normal people process it.

My Linkedin profile explicitly says "No third party recruiters". I have explicitly responded to multiple third party recruiters telling them I do not want my resume in their hand, I don't want to be considered for any position from whatever shitty stealth startup they are working with. Nope. Nothing. I still get emails; GUESS WHAT? THEY ARE FROM THE SAME FUCKING RECRUITER(S).

<comment><USER4> THIS.

We put a job advert up on LinkedIn recently. It said in big bold capital letters at the very top "Absolutely no agencies/recruiters"

Guess what? We got 50+ calls from job agencies in under 1 week. Some, multiple times, even after we politely told them we were not interested and not to contact us again.

My only guess is that people working in recruitment have targets to hit in terms of number of calls to make each day and they'll try and hit that target anyway possible.

<comment><USER2> _My only guess is that people working in recruitment have targets to hit in terms of number of calls to make each day and they 'll try and hit that target anyway possible_

A guess that happens to be 100% accurate. Recruiters are targeted on a huge number of factors, primarily the number of jobs they fill obviously but also the number of new clients acquired, number of clients contacted, candidate contacts, client visits, etc. It's a long list.

</comment></comment></comment></comment><comment><USER5> I honestly don't understand why everyone hates recruiters so much.

Yes, you say they're a "good problem" to have but how are they a problem at all? How much effort does it take to delete an email/message, especially if you automate it?

I just don't understand the fuss. If anything, I enjoy the little ego boost every time I log in to LinkedIn and see another recruiter knocking. It's nice to be wanted.

<comment><USER6> People who are old enough will remember the same argument about e-mail spam; it only takes a second to delete, so what's the problem?

Me, I still don't like spam.

<comment><USER5> > People who are old enough will remember the same argument about e-mail spam

I think that supports my point. Because when was the last time you actually saw spam in your inbox?

<comment><USER7> Yesterday, actually. Somehow it passed through the span filter (of course I marked it as spam but still).

</comment></comment></comment></comment><comment><USER8> Looks like I'm now up to 8 emails from this same recruiter over the past year. She must have quite the list -- a friend also receives messages from her.

<comment><AUTHOR> All a little over a month apart and the last several sent around the same time of day? Within a dozen seconds or so?

</comment></comment><comment><USER9> How do I get this problem? :)

<comment><AUTHOR> 1\. Get a LinkedIn account 2\. Put web tech buzzwords in it - extra points for Ruby, Rails, social, mobile, or big data 3\. Profit

<comment><USER10> Step 3 is _always_ ???. Step 4 is profit.

<comment><USER11> Actually, it is not _always_ "???".

Where this meme originally came from, step 2 was "???" and step 3 was profit[1].

[1] [https://en.wikipedia.org/wiki/File:Gnomes_plan.png](https://en.wikipedia.org/wiki/File:Gnomes_plan.png)

<comment><USER12> The point is, there _is_ always the "???" phase.

</comment></comment></comment></comment></comment><comment><USER13> My usual response to recruiters (if I respond) is a short and polite "Not interested, happy where I am". However, Skyrocket Ventures is different. I've received several calls from them over the last year, all from blocked numbers (Note that I use Google Voice, so it's possible that is the cause).

</comment><comment><USER14> I'll just put this right here.

[http://denniskubes.com/2013/07/18/why-you-should-be-nice- to-...](http://denniskubes.com/2013/07/18/why-you-should-be-nice-to- recruiters/)

</comment><comment><USER15> Surely it's much easier to hit DELETE than to do a reply like this (plus I doubt that the said recruiter will take note, or even read it). By replying you are only serving to waste your time even further.

<comment><AUTHOR> I'm sure she reads every reply, that's how this works you know... She can't place me in that dream job if she doesn't read my reply.

And I was venting - maybe at least she'll stop emailing me.

<comment><USER15> Well I doubt she read it in it's entirety.

btw. it was well written, but that's not really the point here.</comment></comment></comment>


Photovoltaic systems: solar energy based technology - <AUTHOR> http://dev.emcelettronica.com/photovoltaic-systems-solar-energy-based-technology

<comment><AUTHOR> Photovoltaic systems uses solar energy technology.</comment>


Build a Product That Only a Few People Want – But Want Desperately - <AUTHOR> http://www.inc.com/rahul-varshneya/build-a-product-that-only-a-few-people-want-desperately.html

<comment><USER2> It's a good strategy, but I would rephrase it to "Build a Product That Only a Few RICH People Want--But Want Desperately"

</comment><comment><USER3> How can Starbucks be an example of this?

Should they have launched in 20 cities to start, instead of just Seattle?

That's just not how brick & mortar works, of course.

<comment><USER4> Not every company fits into the advice of this article. Starbucks is the exception and not the rule.</comment></comment>


Show HN: I love being more effective in my life, so I made my own Habit app! - <AUTHOR> https://apps.apple.com/ag/app/habit-tracker-minimalist/id1477589572 <comment><USER2> I downloaded a habit app once, the hardest thing about using it was getting in the habit of using it, so I stopped using it.

<comment><USER3> >the hardest thing about using it was getting in the habit of using it, so I stopped using it.

I guess at this point, you could try another Habit app to help you use the existing one? :P

Jokes aside, I think it can take over 2 months for a new habit to be properly formed - so you'll want to stick out your habit app/gym routine/earlier wake- up times for at least 2 months before deciding if they're effective: [https://onlinelibrary.wiley.com/doi/abs/10.1002/ejsp.674](https://onlinelibrary.wiley.com/doi/abs/10.1002/ejsp.674)

</comment></comment><comment><AUTHOR> I've always wanted to make my life more effective by building good habits, but I never found the motivation I needed from the Habit apps out there in the App Store. So I made my own, with milestones to reach in every habit created in the App.

I am still working to improve it, and bring useful statistics, and make it more enjoyable. Any feedback is appreciated!

<comment><USER4> If it applies, this would likely be better as a Show HN:

[https://news.ycombinator.com/showhn.html](https://news.ycombinator.com/showhn.html)

<comment><AUTHOR> Thank you man!

</comment></comment></comment><comment><USER5> When someone say 'mobile app' I assume it's IOS and Android, I'm often wrong. Would it be too hard to prefix 'app' with the platform?

<comment><AUTHOR> I agree, it can be confusing, it's something I can take with me, thanks!

</comment></comment><comment><USER6> Congratulations for your app.

Just recently I was looking for a habit app and currently try out GTDFaster/GSDFaster, which is a mix of GST from David Allen + 7 habits of highly effective people from Steven Corvey.

<comment><AUTHOR> Thank you!

I read his book, Steven Corvey is very interesting!

</comment></comment><comment><USER7> This looks really cool. Any plans to push to Android as well?

<comment><AUTHOR> Sadly not, I would love to reach out to as many people as possible, but the problem is that developing to two both Android and iOS at the same time makes it harder to focus and grow the product from an MVP into a real useful everyday product. And with the limited resources that makes it even harder.

</comment></comment><comment><USER8> What's your business model?

<comment><AUTHOR> I went with subscription model, my goal is to put content in the app, I want a way to inform and recommend users about what "good" Habits there is to implement in life.

I appreciate any suggestion on that.</comment></comment>


Ask HN: Why not fix JavaScript? - <AUTHOR> Hello Hackers,
I have been learning JavaScript and have observed:
1) Most programmers program using javascript libraries(e.g jQuery), whose syntax is not even vaguely similar to pure javascript which often gives so called jQuery programmers a shock when they attempt to do things in Javascript. I would agrue that less than 1% of so called web programmers can do pure javascript programming.
2) Some Popular web frameworks have resorted to choosing altogether different language that "compiles into Javascript". If its not clear I am talking about Ruby on Rails & Coffee-script.
In-short, JavaScript does have not-so-good parts and people are using workarounds to get those bad things to behave nicely.  so as a new Developer looking to learn JavaScript. I face this dilemma of choosing between a) Pure Js b)JS libraries C) language that "compiles into Javascript". And what I have observed there is no right choice, each has its own advantages & disadvantages.
==My Question==
Why not fix the problem(Javascript Standard & its implementations), instead of replying on hackery workarounds that further fragments web-development ecosystem? Aren't workaround are going to hurt us in longer term?
And If there are some improvements coming into JavaScript language, how long we will have to wait till they hit mainstream? <comment><USER2> JavaScript - without a doubt - has it's quirks, but it's a very nice and elegant language if you can restrict yourself to a subset of its features. The ECMAScript 5 standard and the Strict Mode[1] fix some of JavaScript's design problems. It's already implemented in Firefox 4 and should arrive soon-ish in Chrome (v8) and Safari (JavaScriptCore).

Also, jQuery doesn't "fix" JavaScript, it "fixes" the DOM. I.e. jQuery and many other libraries, have little to no use for programming games (shameless plug: e.g. with Impact[2]) or server side stuff. And some of jQuery's ideas have already been implemented natively in browsers[3].

JavaScript is extremely flexible and allows implementations of other languages like Coffescript with relative ease. I don't see a problem with "fragmentation"; it drives innovation.

[1] <https://developer.mozilla.org/en/JavaScript/Strict_mode>

[2] <http://impactjs.com/>

[3] [https://developer.mozilla.org/en/DOM/document.querySelectorA...](https://developer.mozilla.org/en/DOM/document.querySelectorAll)

<comment> wh-uws Yeah a lot of people conflate JavaScript with the DOM because the only place most people see js is in a browser where one of its major purposes is manipulating the DOM. Admittedly the DOM has had a checkered past.

But js's story is much bigger than that.

Also I would argue that jQuery just uses a different set of the language's syntax than many programmers would ever encounter just coming from the c-style languages.

It forces you to use closures before many programmers actually know what one is. Some never do or never need to.

</comment></comment><comment><USER3> I think your unstated assumption is that everything you describe shows that JavaScript is broken. I feel your pain, but a lot of your complaints show just how successful JavaScript really is.

It has libraries to abstract away differences in the underlying platforms -- obscures the miracle that it basically works on different platforms, even written by bitter competitors. What was the last language to do that? C? Perl?

It allows the programmer to create new abstractions like jQuery -- again, this is because of the _good_ parts. It's highly dynamic. Even if JavaScript had all of jQuery from day one, people would still be writing frameworks to reach the next level of abstraction.

As for languages that treat JavaScript as assembly; well, it depends. Sometimes the motivation is to write better applications -- like, people want to define server-client communication at a higher level, or use similar representations of the same concepts on server and client. But that's more of a flaw of the browser (or server) platform, not JavaScript the language. It wouldn't be fixed if we suddenly had python in the browser as a viable scripting language.

The last category are people who treat JS as assembly because it's missing features, as a language, like types, or asynchronous communication, or internationalization. Now these really do show where the flaws in the language are, in my opinion. Some of this is being addressed in newer versions of the language.

<comment><USER4>
        people who treat JS as assembly because it's
        missing features, as a language

Not all features are equal, and what some people might call a "feature", others might call a "flaw". Treating Javascript as assembly is perfectly acceptable.

</comment></comment><comment><USER5> Your dilemma is analysis paralysis. jQuery is widely popular because of what it accomplishes, not just its syntax. And its syntax is totally "pure" JavaScript. How could anyone understand jQuery code that couldn't grok "pure" JS? jQuery is pure JS and does not radically alter the syntax.

The other camp, CoffeeScript (which I use and love) or "Objective-J"... yes they are different languages that compile to JavaScript but why does it bother you? Check out if you like or need them -- if not, stick to JS with or without libraries.

Now get busy =)

</comment><comment><USER6> Hello gary4gar,

1) Libraries offer functionality, they don't change the nature of the language. With this respect, jQuery & al. are not different from libraries you use with java or .Net. This is the same thing as considering the browser API (DOM etc) to be the JRE lib in Java and other libraries just extending the functionality.

2) Or the Google Web Toolkit which uses the Browser's Javascript engine as a form of bytecode interpreter. It is an efficient technique allowing for very compact programmes.

Javascript won't be changed (too much) because it is not broken - it brings an untyped system, closures and other goodies which just recently entered java, not to mention the benefit that it speeds up development because it does not require compilation. Adding libraries and frameworks is what happens just alike to any other programming language which allows other users to bring in new functionality and a different way of thinking.

<comment><USER7> Minor nitpick - JavaScript is dynamically typed rather than untyped :)

<comment><USER6> Oops :D

</comment></comment></comment><comment><USER8> An even better question is "Why does it take at least four different languages for database-backed web applications, and why should developing on the web be so much more of a hassle than on the desktop?

<comment><USER2> You can use JavaScript client side in the browser (duh) as well as on the server (e.g. with NodeJS[1]) and your database (e.g. with CouchDB[2]). The only other languages you need are HTML and CSS. That makes 3, not 4 ;)

[1] <http://nodejs.org/>

[2] <http://couchdb.apache.org/>

<comment><USER9> Aside from recent developments like NodeJS, the lack of interest in JavaScript as a server-side language is really weird. Both Microsoft and Netscape had JavaScript server scripting back in the 1990s, but people instead glommed onto ad-hoc languages written from scratch (PHP) or plucked others out of complete obscurity (Ruby) and made them successful.

I can't help to think that history would have been completely different if someone had created an Apache mod_js 10 years ago.

<comment><USER10> JavaScript is all we have on the client side, but on the server you can choose the best tool for the job. Languages like Ruby and Python are basically supersets of the semantics of JavaScript, but with many more features and large standard libraries. And these languages evolve, while JavaScript have been basically frozen for a decade. The server side language have well-tested libraries for working with the file system, databases and so on.

JavaScript is a nice, minimal language, but a bunch of other languages are just better when you are not constrained by the browser.

Besides, the benefit of having the same language on client and server might not be so great. Sure it looks nicer, but the programming model on client and server is quite different anyway.

Node.js is interesting. I suspect the users will soon want some syntactic sugar for dealing with asynchronicity (something like the new "await" keyword in C#). This is also neede on the client side, but much harder to get support for. But if they extend JS on the server side, does it make sense to compile down to vanilla JS rather that just forking the language?

</comment></comment></comment></comment><comment><USER11> If you'd 'fix' javascript, you'd still have to wait for browsers to support the new version, and they would have to support the old js until there are pages out there that use it. Which means pretty much forever.

At which point, the fixed language becomes irrelevant, as it cannot replace the older one.

</comment><comment><USER12> Is it a workaround that your CPU doesn't run C++ code directly and instead runs assembly, and a compiler is needed to convert C++ to assembly?

The answer is obviously no, so how are 1) and 2) any different? I think they are great things - they encourage competition and allow for much more rapid progress than if there were a single monolithic framework and language that everyone was forced to use. Trying to create a single perfect platform that makes everyone happy is an impossible task.

<comment><USER13> I think it would be interesting though, for browsers to implement a Javascript VM which would allow compilations to byte code from any supported language, rather than source to source translations. Similar to the many languages that compile to run on a JVM (JRuby, Jython, Scala, etc.)

<comment><USER4> Javascript is very dynamic, and it is a decent target from any source language.

And although it would be really cool, I wouldn't want a browser bytecode, because it would make Javascript harder to optimize, while also not improving too much the lives of language developers.

You're mentioning the JVM, but there's a problem with that example. The JVM is freakin' heavy, and optimizations are parts of that. Google had to come up with their own bytecode for Android to lighten the pipeline for mobile phones, and Rhino is a lot worse performance-wise than V8 -- there is not such thing as a language-neutral VM / bytecode that's also efficient. Go ask the developer of Lua-JIT about it ;)

</comment></comment></comment><comment><USER14> Hi gary4gar, Brendan Eich is working on the next version and parts of it will be inspired by CoffeeScript. That said, you will probably be well off learning all three!

<comment><AUTHOR> Easier said than done :(

<comment><USER14> Maybe but I find that both jQuery and CoffeeScript shine a good light on JavaScript's functional side.

I really think you will learn to write better JS by studying it along with CS. When you get the feel of it, I don't think you'll find jQuery that strange.

</comment></comment></comment><comment><USER15> A 'simpler' solution would be to simply offer a complete alternative to javascript in the browser. If they released a new, fixed version of javascript, it would take at least a few years for the other browsers to catch up, assuming they even do (IE won't).

They actually did work out how to 'fix' many of javascript's issues over 10 years ago with the Javascript 2 proposal, but it never happened. <http://www.mozilla.org/js/language/js20-2000-07/index.html> If they had simply added type annotations, for example, javascript would be an order of magnitude faster today, and pretty much every language out there could easily compile to javascript without losing any speed or features.

</comment><comment><USER16> How can you call it fragmentation when everything ultimately turns into valid JavaScript?

</comment><comment><USER17> That's is simple. You're watching it from the wrong perspective dude. When DSLs/Frameworks/Libraries/ spread around languages, it's a strong indicator that the language is highly valueable, but not abstract enough to like it.

What I mean is that it's not easily understandable, fullstop. That's a simple reason for, why people create jQuery,CofeeScript,SproutCore and many other Abstraction Layers.

You will see that only the fittest will survive!

Your question is at the bottom of your post, irony.. Javascript's roots are anchored at the bottom too, you cannot just unearth it and plant it into another pot. But you can graft it :)

Evolution Baby!!

</comment><comment><USER18> The answer is pretty simple: whatever 'fix' you come up with will only last until somebody tries doing yet something else that you hadn't anticipated. At that point, you'll be back to square one.

This is the magic of human ingenuity. It has nothing to do with standards and best practices. That said, Javascript (as a standard) is obviously plenty good enough to let us coerce it in to doing all of these thing (like jQuery, Coffee-script, node.js and so on), that I'd say the people who have steered Javascrip over the years have done a pretty good job, all considered.

</comment><comment><USER19> It's easy to say "just fix it" but it the history behind JavaScript is complex and wacky - and one persons problem is another persons super-powerful closure. If you really want to know the nuts & bolts then you have to watch the Crockford on JavaScript series: [http://developer.yahoo.com/yui/theater/video.php?v=crockonjs...](http://developer.yahoo.com/yui/theater/video.php?v=crockonjs-1)

Yes. All of them!

</comment><comment><USER20> There is no problem to fix - JavaScript is the 2nd best language. LISP is better. KnR C is 3rd. No good language is easy to learn and understand.

<comment><USER13> Unless a language's sole purpose to be easy to learn and understand. Then by definition it's a great language.

Use the right tools for the right job. A jewelers file is pretty worthless if you are building a house. Likewise a hammer isn't very useful in the finishing touches of a diamond ring.

</comment></comment><comment><USER21> Microsoft threw a fit when Adobe proposed a significantly improved version of Javascript (inspired by modern ActionScript, not surprisingly).

<comment><USER10> That is only partially true. Microsoft actually released JScript.net, which was an implementation of the proposal on the .net platform. Later they changed strategy and decided they didn't want to support the proposal, and JScript.net is not supported anymore. But the fact remains that MS has delivered the only other implementation of the (now rejected) proposal apart from ActionScript (AFAIK).

</comment></comment><comment><USER22> Because it would take roughly 1 billion years for those standards to have actual, web-wide meaning (thanks in no small part to the popularity of Microsoft's so-called browsers).</comment>


Github outage official status updates - <AUTHOR> http://status.github.com

<comment><USER2> Github has been so reliable for me that their website was the last place I looked! When I saw:

       Permission denied (publickey).
       fatal: The remote end hung up unexpectedly

my first response was to check that ~/.ssh was unmolested.

</comment><comment><USER3> But thanks to the magic of DVCS, everybody can still hack :-)

</comment><comment><USER4> The website is still intermittent, but as of now command line access seems to be fully operational.

</comment><comment><USER5> Even the status page is intermittently down ("too many requests on the app backlog"), poor Heroku.

<comment><USER2> Having a 30 second automatic refresh on the status page can't help.

(Edit: Also, my Heroku apps are fine. Makes me feel a bit more secure about multi-tenant hosting.)

<comment><USER6> Yeah. It's definitely not a heroku issue. We were configured to run on a single backend. It's since been increased and should be better now.

</comment></comment></comment><comment><USER7> They probably briefly overlooked a problem while busy drinking whiskey and opening doors for ladies. As soon as the issue came to light, someone kicked the server with their hard shoe and brought it back online.

</comment><comment><USER8> "from a few days ago" - seriously?

<comment><USER9> "GitHub Pages config backup", not pages themselves (the way I understand it at least).</comment></comment>


What Is CrowdStrike and Why Is Donald Trump Blabbering About It to Ukraine - <AUTHOR> https://www.vice.com/en_us/article/zmjy33/donald-trump-ukraine-zelensky-crowdstrike-phone-call <comment><USER2> Trump has been informed that CrowdStrike never found shit and never could have. It was a hit job, 'IP from RUSSIA, RUSSIAN, CYRILLIC characters!'... anyone who understands these technologies understands that's stupid. I buy a VPN, tunnel to RU, insert some cyrllic in my code, send an exploit, and that's your so-called "evidence" and "proof". Help me see this otherwise, honestly.

<comment><USER3> Like including "Guccifer 2.0" the "hacker" that originally claimed responsibility for the DNC breach being outed as a Russian intel agent directly linked to the GRU or aside from that?

<comment><USER2> Anyone can claim responsibility, and moreover, being 'responsible' doesn't mean you had some capabilities. Such as with skiddies who employ a chinese DDOS botnet. The people responsible are the ones running the botnets and selling their useage, not the people trying to utilize this.

<comment><USER3> Have you tried just researching this a little? I think it would answer most of your questions.</comment></comment></comment></comment>


Benchmarking the Go frontend for GCC 4.8.0 - <AUTHOR> http://www.alsonkemp.com/programming/synthetic-performance-of-the-go-frontend-for-gcc/

<comment><USER2> This seems too simplistic. I am almost tempted to download the two frontends just to see why it is so much bigger.

Lots of inlining (which -O3 would cause, it always does. I often find -O2 produces faster executables)? Debugging information? Pulling in the standard library?

A compiler doesn't produce an extra 3MB of code for no good reason.

<comment><USER3> Yeah, static linking could explain the code size difference. On my machine where I have gccgo 4.8 built and installed the Gccgo produced executable is way smaller than go 1.1 rc1 built. Go builds static executables whereas installed gccgo with just -O3 builds a dynamic one.

<comment><USER4> Run 'strip' on it.

<comment><USER3> 'strip' will remove symbols - debug or unused, but that doesn't change the way static libraries work - all the code, instead of being in the shared library dependency is stuffed into the executable. That's still going to be there.

</comment></comment></comment></comment><comment><USER5> Why would anyone care about relative code size or compile time for a program this small? This is obviously a "cost of entry" issue.

I have trouble imagining that doubling the code size and complexity of the "mandel" example would double the compile time or code size with either example. Why not try a handful of programs to get a scatterplot between the two toolchains?

<comment><AUTHOR>
        Why would anyone care about relative code size or compile
        time for a program this small?

Because it can be extrapolated [obviously, not perfectly]... The nice thing about a mandelbrot benchmark is that it's FP and optimization driven, so does a decent quick-and-dirty job of illuminating the parallelizable performances produced by different compilers. Once you add in regexes, databases, etc, you move beyond the compiler and on to the performance of secondary or tertiary systems.

        Why not try a handful of programs to get a scatterplot
        between the two toolchains?

Because relative to the question I was trying to answer ("as someone investigating Go, should I also investigate GCCGo?"), that would be a waste of time. Were I to have gotten a result that suggested that GCCGo was markedly better along _some_ dimension, I would have done more testing to quantify "markedly".

Go is a lovely, young language, but the GCCGo implementation is very young. The GCCGo folks will catch up soon enough with Google. Until then, Google has produced a nice toolchain for you.

<comment><USER5> I'm not arguing that it's a bad microbenchmark for FP run-time performance.

I'm arguing that it's a bad microbenchmark for compile time and code size. I'm not all that familiar with go, but in most systems I've used, if you write a really tiny program, you will find that there's a "fixed cost of entry' where the standard libraries get munged through the linker (or whatever) and that writing a program 10x larger will not cost you 10x as much. Since you took only one measurement of one program, you have no idea what the trend lines might look like here.

It seems like you are going out of your way to do this badly and make a snap judgement that you can proclaim to the world.

I am surprised at the extent to which you seem to think you need to ration your investigation and avoid wasting your time by the exhausting task of "also investigating GCCGo".

Also, in the world of high-performance computing, 10% for zero programmer effort is _huge_.

</comment></comment></comment><comment><USER6> The article doesn't mention which version of gc and which version of gccgo was used. Why do people post benchmarks without such basic information?

<comment><AUTHOR> Apologies. Though the HN post title says 4.8.0, I didn't mention anything about it or the Go version in the blog post. I'll add those. GCC was 4.8.0. Go was 1.1rc1. Both AMD64.

</comment></comment><comment><USER7> I'm also curious about a larger swath of tests -- a single algorithm can hardly characterize a whole compiler.

<comment><USER8> Not only that, but I have heard people say that for compute (code generation) bound tests that are single threaded GCCGO does better; however, if you run code with many goroutines (which most Go programs have) the standard Go compiler is faster.

As of 1.1 Go code generation is also drastic improved. I would love to see Go 1.0.3 vs Go 1.1 vs GCCGO tests with a wide sample of programs.

<comment><USER9> Did some of the go benchmarks on the lunch-break, I used standard 'go build' for the go results, and "go build -compiler gccgo -gccgoflags '-O3 -march=native'" for the gccgo results.

The compilers where : Go 1.1rc, GccGo version 4.8.0 20130502 (prerelease), on an Arch Linux 64-bit system, Core i5

      binary-tree.go
      gccgo-4.8:  0m0.932s
      go-1.1rc1:  0m1.835s

      binary-tree-freelist.go
      gccgo-4.8:  0m0.165s
      go-1.1rc1:  0m0.307s

      chameneosredux.go
      gccgo-4.8:  0m10.163s
      go-1.1rc1:  0m5.620s

      fannkuch.go
      gccgo-4.8:  0m44.533s
      go-1.1rc1:  0m56.389s

      fannkuch-parallel.go
      gccgo-4.8:  0m26.525s
      go-1.1rc1:  0m27.855s

      fasta.go
      gccgo-4.8:  0m1.126s
      go-1.1rc1:  0m1.250s

      mandelbrot.go
      gccgo-4.8:  0m30.004s
      go-1.1rc1:  0m30.537s

      nbody.go
      gccgo-4.8:  0m11.423s
      go-1.1rc1:  0m12.620s

      pidigits.go
      gccgo-4.8:  0m7.333s
      go-1.1rc1:  0m2.321s

      spectral-norm.go
      gccgo-4.8:  0m12.259s
      go-1.1rc1:  0m13.389s

      spectral-norm-parallel.go
      gccgo-4.8:  0m3.142s
      go-1.1rc1:  0m6.695s

      threadring.go
      gccgo-4.8:  0m37.421s
      go-1.1rc1:  0m9.800s

Overall I'd say Go did better as in the instances GccGo won (although more numerous) it was typically with a small margin while on those GccGo lost we had larger margins.

Overall Go 1.1rc seems to have improved quite a bit from my previous test (1.0x) unless my memory betrays me.

Note that these are far from all the 'computer language benchmarks game' tests, only those which I managed to get done during lunch break, and as such they may skew the results compared to a full benchmark comparison.

<comment><USER10> Note, the programs in go/test/bench are not necessarily the same as the Go programs shown on the benchmarks game.

Most to the point, the mandelbrot program shown on the benchmarks game is not the same -- someone contributed an improved program to the benchmarks game.

<comment><USER9> Good to know, as such it would be a more apt comparison to use the currently best Go versions from the benchmarks game as they better reflect where Go stands performance-wise (with the usual micro benchmark disclaimer).

<comment><USER10> And to be fair, that's what CoffeeDregs did originally.

</comment></comment></comment></comment></comment></comment><comment><USER11> IMHO, both compile fast enough. Either gccgo or gc, it's acceptable, and is much faster than compiling a similar-size C program. What matters would be the code they produce. Compiler optimization is what makes the difference.

</comment><comment><USER12> In the snippets for `time`, by the end of the article, the `>` symbols have been escaped to their HTML equivalent:

       time ./mandel.golang 16000 > /dev/null
       time ./mandel.gccgo 16000 > /dev/null

They also happen to be within two `<pre>` tags. I guess there's something wrong in the rendering of your snippets.

I say 'your' assuming that OP is the author.

<comment><AUTHOR> You're correct about "your". Fixed. Thanks.

</comment></comment><comment><USER13> How long did each take to compile?

<comment><AUTHOR> I'll add that, but: GCCGo Direct [not called by go]: 0.3s Go: 0.5s</comment></comment>


Peter Thiel Has New Initiative To Pay Kids To "Stop Out Of School" - <AUTHOR> http://techcrunch.com/2010/09/27/peter-thiel-drop-out-of-school/?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Techcrunch+%28TechCrunch%29&utm_content=My+Yahoo <comment><USER2> Like a lot of Peter Thiel's smarter moves, this one is hard to explain without an awful lot of background exposition. Think of people as having to pass through a number of filters before they can do anything important with their lives. As the system becomes increasingly rigid, it filters out almost everyone. It's important to keep bypasses open at every point for people who are capable of dissent and not easy to force into molds. Intervening at the right filter point potentially has a lot of leverage.

</comment><comment><USER3> The interview is far more interesting than the segment on dropping out of school. The section on economic disconnect silicon valley and rest of the US and Thiel's thoughts on the maturity of the internet industry compared to the evolution of the automobile industry and comparing that to hard-tech is worth the price of admission.

Thiel always strikes me as something between the Buffet / Soros of the startup world.

<comment><USER4> link to the interview <http://www.youtube.com/watch?v=MQFLn65pxbQ> sound quality is terrible though...

</comment></comment><comment><USER5> This is outstanding.

Worst case scenario: You fail utterly, you're a whole lot smarter, and if you really want/need to, you go back to school.

With the experience gained, you make a better decision about what you want to study, because you'll know how you want to use it and you'll know what you don't like doing. (I'd give anything to be able to go back in time and choose CS instead of what I did study, back when I was 18, stupid, and locking myself into college.)

More likely than not, you'll re-join college with awesome work opportunities that carry through until after you graduate, where great prospects are waiting for you.

On the other hand, you could build something amazing that alters the trajectory of your whole career.

</comment><comment><USER6> Couldn't there be some middle road: go to a school that is less expensive, and not for too long? At least for a 3 year BSc... University can still be fun and inspiring, and it is difficult to recreate the experience in another way. Also if you are too old when you go to university, it won't be the same.

A lot of people seem to advocate not to quit one's day job, but work on projects on the side. While personally I can't do that, it might be a lot easier to arrange some spare time as a student. So why not go that route - study, but do some interesting stuff on the side?

What does it cost for Americans to study in Europe? I think you can find here (Europe) some universities that are good and don't cost the world.

A friend of mine is actually an assistant at a chair for entrepreneurship here in Berlin. If you go to that university, they will try to nurture you into doing a startup: <http://www.entrepreneurship.de/> (german site, didn't find english page, sorry).

</comment><comment><USER7> Universities might be bloated, wasteful, and expensive, but I don't think I would recommend to any kids that they skip college and take a major gamble for only $100,000. Sure, one or two of these idea kids might make it big, but the rest will do nothing. With a good college degree you can easily make $100,000 in less than two years.

<comment><USER8> _With a good college degree_

Differentiating between good and bad ones may be a large part of the issue.

 _you can easily make $100,000 in less than two years_

This where I have to disagree, especially if you're talking about $100k _net_ , that is, in addition to paying off the extra college costs for those (less than) two years.

Moreover, I think the context of the OP is that the grant being offered is to disrupt by building something of value. Ideally, at the end of the 3-4 years (what it would take to finish college and earn the afformentioned $100k), one is left with much more value in what one built and possibly even much more money in the form of further investment. In the worst case, one is left with extremely valuable, arguably more so than a degree and a couple years of employment, experience.

</comment></comment><comment><USER9> He lost a few points in my book for saying new startups will not be able to take on the big tech companies.

Imagine if the founders of Google took his advice.

<comment><USER10> Portals do not a tech company make.

Yahoo called itself a media company, and many others emulated their all-in-one portal model with search as an after thought.

Google focused only on their index and their PageRank algorithm to provide the best intent based search possible.

They weren't in a contest with the tech companies. They were just a feature to Yahoo way back when.

</comment></comment><comment><USER11> Note the extra querystring arguments in the url: ?utm_source=feedburner&utm_medium=feed&utm_campaign=Feed%3A+Techcrunch+%28TechCrunch%29&utm_content=My+Yahoo

I wonder if replicating this stuff messes up techcrunch's metrics significantly?

</comment><comment><USER12> Does anyone know the application process for this initiative? I've been looking around and can't find a damn link anywhere to apply for this.

</comment><comment><USER13> Sounds rational to me.</comment>


The U.S. Bought 3 Virgin Islands from Denmark. The Deal Took 50 Years - <AUTHOR> https://www.history.com/news/us-virgin-islands-denmark-purchase <comment><USER2> This link at the bottom of the article about Puerto Rico is also an interesting read: [https://www.history.com/news/puerto-ricos-complicated- histor...](https://www.history.com/news/puerto-ricos-complicated-history-with- the-united-states) .

</comment><comment><USER3> We owe voting rights and statehood to the island nations we colonized during the past century.

<comment><USER4> No more than we did to any other English-speaking US territory in the 19th or 20th century that didn't have enough people for statehood. (And before you bring up Puerto Rico, a) it's not English-speaking and b) no, it's not true that its people have ever voted for statehood, whether in 2017 or any other year.) If Guam or USVI ever gets to a population closer to that of one of the smaller US states, and its people vote to apply for statehood, we'll talk then. Same goes for Greenland should the US buy it, hordes of Americans migrate to it, and it develops a substantial English-speaking population.

<comment><USER5> Why would English speaking have anything to do with applying for statehood?

<comment><USER4> Because English is vital to being part of a unified American culture.

If the US annexed Canada, I would also not want Quebec as a state for the same reason. Either make it a territory or give it independence.

<comment><USER6> I consider the current native speakers of New Mexican Spanish, whose family settled in New Mexico in the 1600s, to be equally a part of the "unified American culture" as you are.

The same for the Amish who speak Pennsylvanian German, the Gullah speaking people, the Cajun speakers, and the many indigenous people of North America who speak Navajo, or Hawaiian, or language at home.

<comment><USER7> +1</comment></comment></comment></comment></comment></comment>


Is there room for another Hacker News? - <AUTHOR>

Just wondering, is there room for another hacker news type site, only a little more focused? <comment><USER2> Same idea, different slant:

<http://www.newmogul.com/>

The Internet is always evolving; probably something like 89 percent of the Internet spends its time talking about how the other 11 percent evolves.

</comment><comment><USER3> Yes, especially if it's in a language other than English.

</comment><comment><USER4> Electrons don't take up much space. Following websites takes TIME, however, so it's up to users to decide how they like to use their time.

</comment><comment><USER5> Yes.

Go build it.

Post link when done.

Thx.</comment>